Summary
Applications can install a WireframeProtocol, but the WireframeApp server response path never passes its hooks to FramePipeline, so normal handler responses skip before_send and related protocol controls.
Tracking
Canonical finding id: csf_bd0aaf3ef8ecfa78a5425786
Primary fingerprint: codex-security/v1:sha256:03a4251d7d546df5249fbc3dbc7423c5bbbd814098c058ac7d58ddb7f66f4cf5
Scan id: 3969c3b0af5f_20260624T110328Z
Candidate ids: wireframe-app-protocol-hooks-bypass-001
Severity
Severity: medium
Confidence: high
CWE: CWE-693
Rationale: The bypass affects a documented security-control extension point but requires application reliance on that hook for security-sensitive behavior, so severity is medium.
Source
Repository: https://github.com/leynos/wireframe
Scanned target: git_worktree snapshot at revision 3969c3b
Source status: unverified for commit-pinned links because the sealed target kind is git_worktree; locations are listed as canonical plain paths.
- Location (root_control): src/app/frame_handling/response.rs:59-62
- Location (sink): src/app/codec_driver.rs:56-70
- Location (sink): src/app/codec_driver.rs:108-111
- Location (configuration): src/app/builder/protocol.rs:32-39
- Location (safe_sibling): src/connection/frame.rs:85-90
Root cause
The invariant should be that configured protocol hooks are consistently applied on outbound frames. The implementation stores the protocol and provides hooks, but the app response pipeline does not receive or invoke them.
Recommended fix
Thread ProtocolHooks or the installed protocol through the WireframeApp response pipeline and invoke before_send before serialization. Add tests showing with_protocol(...).before_send mutates server app responses.
Regression tests
- Add an integration test that configures
with_protocol and asserts before_send runs for a normal WireframeApp handler response.
Public issue note
This issue intentionally omits code snippets and detailed attack-path notes from the sealed scan report.
Summary
Applications can install a
WireframeProtocol, but theWireframeAppserver response path never passes its hooks toFramePipeline, so normal handler responses skipbefore_sendand related protocol controls.Tracking
Canonical finding id: csf_bd0aaf3ef8ecfa78a5425786
Primary fingerprint: codex-security/v1:sha256:03a4251d7d546df5249fbc3dbc7423c5bbbd814098c058ac7d58ddb7f66f4cf5
Scan id: 3969c3b0af5f_20260624T110328Z
Candidate ids: wireframe-app-protocol-hooks-bypass-001
Severity
Severity: medium
Confidence: high
CWE: CWE-693
Rationale: The bypass affects a documented security-control extension point but requires application reliance on that hook for security-sensitive behavior, so severity is medium.
Source
Repository: https://github.com/leynos/wireframe
Scanned target: git_worktree snapshot at revision 3969c3b
Source status: unverified for commit-pinned links because the sealed target kind is
git_worktree; locations are listed as canonical plain paths.Root cause
The invariant should be that configured protocol hooks are consistently applied on outbound frames. The implementation stores the protocol and provides hooks, but the app response pipeline does not receive or invoke them.
Recommended fix
Thread
ProtocolHooksor the installed protocol through theWireframeAppresponse pipeline and invokebefore_sendbefore serialization. Add tests showingwith_protocol(...).before_sendmutates server app responses.Regression tests
with_protocoland assertsbefore_sendruns for a normalWireframeApphandler response.Public issue note
This issue intentionally omits code snippets and detailed attack-path notes from the sealed scan report.